If SDAIA Calls Tomorrow, Who Answers? And Can They Prove the Number?

The breach notice isn’t a paragraph you draft under pressure

Within 72 hours of detecting an incident, not assessing it, SDAIA has to be notified. The notice needs to include the data categories affected, the type of personal data, and the number of people affected, either actual or approximate.

Where things actually break down

Most organizations can name a person to answer the call. Far fewer can back that number with evidence. The reason is simple: the number requires a real, current picture of who the affected data belongs to, not a guess from memory or a spreadsheet nobody has touched in a year.

Real readiness means the number already exists before the incident happens, not something assembled after the fact while the clock is running.